@waffo/pancake-ts 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `@waffo/pancake-ts` will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.2] - 2026-04-03
+
+### Fixed
+
+- **Checkout idempotency** — Checkout methods (`anonymous.create()`, `authenticated.create()`, `createSession()`) now use time-windowed idempotency keys (60-second window) instead of fully deterministic keys. Previously, identical checkout params always produced the same `X-Idempotency-Key`, causing the gateway to return cached (and potentially expired) sessions. Now, same params within the same minute are still deduped (protects against network retries), but a new key is generated after the window elapses.
+- **Timestamp consistency** — `Date.now()` is now called once per request and shared between signature timestamp and idempotency key calculation, eliminating a theoretical edge case where the two could land in different seconds.
+
+### Internal
+
+- **`PostOptions` interface** — Extracted inline `{ idempotencyWindow?: number }` into a named type in `types.ts` (not publicly exported).
+
 ## [0.2.1] - 2026-04-02
 
 ### Added

package/dist/index.cjs

@@ -222,18 +222,26 @@ var HttpClient = class {
    *
    * Behavior:
    * - Generates a deterministic `X-Idempotency-Key` from `merchantId + path + body` (same request produces same key)
+   * - When `idempotencyWindow` is set, a floored timestamp is mixed into the key so identical params produce
+   *   a new key after the window elapses (useful for checkout where repeated creation is intentional)
    * - Auto-builds RSA-SHA256 signature (`X-Merchant-Id` / `X-Timestamp` / `X-Signature`)
    * - Unwraps the response envelope: returns `data` on success, throws `WaffoPancakeError` on failure
    *
    * @param path - API path (e.g. `/v1/actions/store/create-store`)
    * @param body - Request body object
+   * @param options - Optional settings
+   * @param options.idempotencyWindow - Time window in seconds for idempotency key rotation (e.g. 60 = per-minute dedup)
    * @returns Parsed `data` field from the response
    * @throws {WaffoPancakeError} When the API returns errors
    */
-  async post(path, body) {
+  async post(path, body, options) {
     const bodyStr = JSON.stringify(body);
-    const timestamp = Math.floor(Date.now() / 1e3).toString();
+    const now = Date.now();
+    const timestampSec = Math.floor(now / 1e3);
+    const timestamp = timestampSec.toString();
     const signature = signRequest("POST", path, timestamp, bodyStr, this.privateKey);
+    const idempotencyBase = `${this.merchantId}:${path}:${bodyStr}`;
+    const idempotencyInput = options?.idempotencyWindow ? `${idempotencyBase}:${Math.floor(timestampSec / options.idempotencyWindow)}` : idempotencyBase;
     const response = await this._fetch(`${this.baseUrl}${path}`, {
       method: "POST",
       headers: {
@@ -241,7 +249,7 @@ var HttpClient = class {
         "X-Merchant-Id": this.merchantId,
         "X-Timestamp": timestamp,
         "X-Signature": signature,
-        "X-Idempotency-Key": (0, import_node_crypto2.createHash)("sha256").update(`${this.merchantId}:${path}:${bodyStr}`).digest("hex")
+        "X-Idempotency-Key": (0, import_node_crypto2.createHash)("sha256").update(idempotencyInput).digest("hex")
       },
       body: bodyStr
     });
@@ -528,7 +536,8 @@ var CheckoutAnonymousResource = class {
     validateCheckoutCommon(params);
     return this.http.post(
       "/v1/actions/checkout/create-session",
-      params
+      params,
+      { idempotencyWindow: 60 }
     );
   }
 };
@@ -568,11 +577,11 @@ var CheckoutAuthenticatedResource = class {
       this.http.post("/v1/actions/auth/issue-session-token", {
         storeId: params.storeId,
         buyerIdentity
-      }),
+      }, { idempotencyWindow: 60 }),
       this.http.post("/v1/actions/checkout/create-session", {
         ...sessionFields,
         buyerEmail: buyerEmail ?? buyerIdentity
-      })
+      }, { idempotencyWindow: 60 })
     ]);
     return {
       sessionId: sessionResult.sessionId,
@@ -615,7 +624,7 @@ var CheckoutResource = class {
    * // Redirect to session.checkoutUrl
    */
   async createSession(params) {
-    return this.http.post("/v1/actions/checkout/create-session", params);
+    return this.http.post("/v1/actions/checkout/create-session", params, { idempotencyWindow: 60 });
   }
 };